KosmoKrator

productivity

HashiCorp Vault MCP Integration for Generic MCP Clients

Connect HashiCorp Vault to Generic MCP Clients through the local KosmoKrator MCP gateway with scoped tools, credentials, and write policy.

7 functions 5 read 2 write API token auth
Submit HashiCorp Vault feedback View package source

Connect HashiCorp Vault to Generic MCP Clients

Connect any stdio-compatible MCP client to local KosmoKrator integration tools.

Register kosmo mcp:serve as the command for a local stdio MCP server. The gateway is local, scoped to this integration, and starts with --write=deny so MCP clients can inspect read-capable tools without receiving write access by default.

HashiCorp Vault MCP Config for Generic MCP Clients

Start with read-only write policy and expand only for trusted projects.

{
  "mcpServers": {
    "kosmokrator-vault": {
      "type": "stdio",
      "command": "kosmo",
      "args": [
        "mcp:serve",
        "--integration=vault",
        "--write=deny"
      ]
    }
  }
}

Run the Gateway Manually

kosmokrator mcp:serve --integration=vault --write=deny

Why Use KosmoKrator Here

Scoped tools

Expose only HashiCorp Vault instead of a broad multi-service tool list.

Local credentials

Reuse credentials already configured for the KosmoKrator CLI and Lua runtime.

Write policy

Start read-only, then opt into ask or allow for trusted workspaces.

HashiCorp Vault Tools Visible to MCP clients

MCP clients sees stable MCP tool names generated from the HashiCorp Vault integration catalog.

MCP toolSource functionTypeDescription
integration__vault__vault_list_secrets vault.vault_list_secrets Read List secrets at a given path in a HashiCorp Vault KV v2 secrets engine. Returns the keys (directory entries) at the specified path.
integration__vault__vault_get_secret vault.vault_get_secret Read Get the latest version of a secret from a HashiCorp Vault KV v2 secrets engine. Optionally specify a version number to retrieve a specific version.
integration__vault__vault_create_secret vault.vault_create_secret Write Create or update a secret in a HashiCorp Vault KV v2 secrets engine. Provide the secret path and a key-value data object.
integration__vault__vault_delete_secret vault.vault_delete_secret Write Permanently delete all versions and metadata of a secret from a HashiCorp Vault KV v2 secrets engine. This action is irreversible.
integration__vault__vault_list_policies vault.vault_list_policies Read List all ACL policies configured in HashiCorp Vault. Returns an array of policy names.
integration__vault__vault_get_policy vault.vault_get_policy Read Get details of a specific ACL policy in HashiCorp Vault, including its name and HCL rules.
integration__vault__vault_get_current_user vault.vault_get_current_user Read Look up the current Vault token's information, including display name, policies, TTL, and metadata.

Related HashiCorp Vault Pages

HashiCorp Vault CLIUse direct JSON commands instead of MCP discovery. HashiCorp Vault MCPFull gateway reference and MCP tool names. KosmoKrator for MCP clientsClient-level gateway setup.